Design assistance device, design assistance method, and design assistance program

Abstract

A record structure generation unit (22) generates a record structure (34) for recording design information regarding security measures related to a product in question, the record structure (34) containing structured details about what should be considered when implementing security measures. A design acquisition unit (23) successively acquires design information (33) regarding security for a product in question during the development process for the product in question. Every time the design information (33) is acquired by the design acquisition unit (23), a record management unit (24) records the design information (33) in the record structure (34) generated by the record structure generation unit (22).

Description

Design support device, design support method, and design support program

[0001] The present disclosure relates to a technology for supporting security design.

[0002] When developing a product, it is necessary to implement security measures for the product without any omissions. To implement security measures without any omissions, technologies have been proposed to format and visualize design information about security measures and to support reviews or evaluations during development.

[0003] Patent Document 1 describes a technique in which a design document conforming to the ISO / IEC 15408 certification standard is used as input, and the relationships between the information described in the design document are visualized using a structure called a relevance map.

[0004] JP 2009-271789 A

[0005] When evaluating whether security measures have been implemented without any omissions, it is desirable to also evaluate from the perspective of whether the design process for the security measures is appropriate. The technology described in Patent Document 1 makes it possible to understand the relationships between information described in design documents. However, the technology described in Patent Document 1 does not record information obtained during the design process for security measures, making it impossible to trace the information later. Therefore, the technology described in Patent Document 1 does not allow evaluation from the perspective of whether the design process for security measures is appropriate. The present disclosure aims to enable evaluation from the perspective of whether the design process for security measures is appropriate.

[0006] A design support device according to the present disclosure includes a record structure generation unit that generates a record structure for recording design information about security measures for a target product, the record structure structuring content that should be considered when implementing the security measures; a design acquisition unit that sequentially acquires design information about security for the target product during a development process of the target product; and a record management unit that records the design information in the record structure generated by the record structure generation unit each time the design information is acquired by the design acquisition unit.

[0007] In this disclosure, design information is recorded each time it is acquired during the development process of a target product in a structured recording structure that defines the content to be considered when implementing security measures. This makes it possible to later trace the information obtained during the design process of security measures. As a result, it becomes possible to evaluate the appropriateness of the design process for security measures.

[0008] FIG. 1 is a hardware configuration diagram of a design support device 10 according to a first embodiment. FIG. 2 is a functional configuration diagram of the design support device 10 according to the first embodiment. FIG. 3 is a flowchart showing a processing flow of the design support device 10 according to the first embodiment. FIG. 4 is a diagram showing an example of an analysis result 31 according to the first embodiment. FIG. 5 is a diagram showing an example of a template 32 according to the first embodiment. FIG. 6 is a diagram showing an example of a recording structure 34 according to the first embodiment. FIG. 7 is a diagram showing an example of a recording structure 34 according to the first embodiment. FIG. 8 is a diagram showing an example of output information 35 according to the first embodiment.

[0009] First Embodiment *** Description of Configuration *** The hardware configuration of a design support device 10 according to the first embodiment will be described with reference to Fig. 1. The design support device 10 is a computer. The design support device 10 includes the following hardware: a processor 11, a memory 12, a storage 13, an input interface 14, a display interface 15, and a network interface 16. The processor 11 is connected to other hardware via signal lines and controls the other hardware.

[0010] The processor 11 is an IC that performs processing. IC stands for Integrated Circuit. Specific examples of the processor 11 include a CPU, a DSP, and a GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0011] The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 include SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0012] The storage 13 is a storage device that stores data. A specific example of the storage 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. The storage 13 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0013] The input interface 14 is an interface for connecting an input device. A specific example of the input interface 14 is a USB port. USB is an abbreviation for Universal Serial Bus. Specific examples of the input device are a keyboard and a mouse.

[0014] The display interface 15 is an interface for connecting a display device. A specific example of the display interface is an HDMI (registered trademark) port. HDMI stands for High-Definition Multimedia Interface. A specific example of the display device is an LCD. LCD stands for Liquid Crystal Display.

[0015] The network interface 16 is an interface for communicating with external devices, and is specifically an Ethernet (registered trademark) port.

[0016] The functional configuration of the design support device 10 according to the first embodiment will be described with reference to FIG. 2. The design support device 10 includes, as functional components, a result acquisition unit 21, a record structure generation unit 22, a design acquisition unit 23, a record management unit 24, and an output unit 25. The functions of each functional component of the design support device 10 are realized by software. The storage 13 stores programs that realize the functions of each functional component of the design support device 10. These programs are loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the functions of each functional component of the design support device 10 are realized.

[0017] The memory 12 stores analysis results 31, templates 32, design information 33, a recording structure 34, and output information 35. The storage 13 also implements a template DB 41 that stores a plurality of templates 32. DB is an abbreviation for DataBase.

[0018] 1 shows only one processor 11. However, there may be a plurality of processors 11, and the plurality of processors 11 may cooperate to execute programs that realize the respective functions.

[0019] ***Description of Operation*** The operation of the design support device 10 according to the first embodiment will be described with reference to Figures 3 to 9. The operation procedure of the design support device 10 according to the first embodiment corresponds to the design support method according to the first embodiment. Furthermore, the program that realizes the operation of the design support device 10 according to the first embodiment corresponds to the design support program according to the first embodiment.

[0020] The processing flow of the design support device 10 according to the first embodiment will be described with reference to FIG. 3. (Step S1: Result Acquisition Unit) The result acquisition unit 21 acquires an analysis result 31 indicating security measures required for a target product. The analysis result 31 is information identified by performing a security risk analysis on the target product. The analysis result 31 indicates a configuration diagram of the target product, security measures, information assets, threats, risk values, security requirements, and the like. For example, the analysis result 31 is information as shown in FIG. 4. In FIG. 4, security measures, information assets, threats, risk values, and notes are shown for at least some components shown in the configuration diagram of the target product. The notes record setting information about the security measures, and the like. The analysis result 31 may further include the value of the information assets, the likelihood of threats occurring, and the like.

[0021] (Step S2: Generation Determination Process) The recording structure generation unit 22 determines whether or not it has generated as many recording structures 34 as the number of security measures indicated by the analysis result 31 obtained in step S1. When the analysis result 31 of FIG. 4 has been obtained, the recording structure generation unit 22 extracts the names set in the security measure column of each row. Then, the recording structure generation unit 22 can identify the number of security measures by counting the number of different names. When the recording structure generation unit 22 has not generated as many recording structures 34 as the number of security measures, it proceeds to step S3. At this time, the recording structure generation unit 22 selects as processing targets a security measure that has not yet been selected as a processing target. On the other hand, when the recording structure generation unit 22 has generated as many recording structures 34 as the number of security measures, it proceeds to step S5.

[0022] As a result, the processes from step S3 to step S4 are repeatedly executed for the number of security measures, and a record structure 34 is generated for each security measure indicated by the analysis result 31.

[0023] (Step S3: Template Acquisition Process) The record structure generation unit 22 acquires the template 32 corresponding to the security measure to be processed from the template DB 41.

[0024] The template DB 41 is a database that stores a plurality of templates 32. The templates 32 are registered in advance in the template DB 41 by an administrator of the design support device 10, a security expert, or the like. The templates 32 are data that serve as models for generating a recording structure 34. The templates 32 are data organized in a tree structure, with the contents to be considered when implementing security measures hierarchically categorized according to at least one of the steps in the design and development process and the level of specificity of the contents. For example, as shown in FIG. 5 , the template 32 is data that has the names of security measures as the root node, the names of security policy measures as child nodes, and the names of component elements for each policy as grandchild nodes.

[0025] The record structure generation unit 22 searches the template DB 41 for a corresponding template 32 using the name of the security measure to be processed as a keyword. In this way, the record structure generation unit 22 acquires the template 32 that corresponds to the security measure to be processed. Note that there may be cases where a template 32 corresponding to the keyword is not found. In such cases, the record structure generation unit 22 displays a list of the templates 32 stored in the template DB 41 and allows the user to select a template 32 related to the name of the security measure.

[0026] (Step S4: Recording Structure Generation Process) The recording structure generation unit 22 generates a recording structure 34 from the analysis result 31 acquired in step S1 and the template 32 acquired in step S3.

[0027] The recording structure 34 has a tree structure indicated by the template 32 and is a data structure capable of recording information in association with each node. Each node is associated with information such as the design rationale and information raised during the design review process. Each node may also be associated with auxiliary information using meta-information such as tags. The auxiliary information may include, for example, threats targeted by security measures, the locations where the measures are implemented, the logical relationships between each node, whether or not the design content indicated by the node should be adopted, and the degree to which the design content indicated by the node is fulfilled. The logical relationships between each node may include, for example, the requirement that the components indicated by all child nodes must be satisfied, the requirement that the components indicated by at least one child node must be satisfied, etc.

[0028] For example, the record structure generation unit 22 generates an issue on Git for each node in the template 32 acquired in step S3. The record structure generation unit 22 generates meta information, such as tags, for the issues according to the tree structure indicated by the template 32. The record structure generation unit 22 then generates a record structure 34 by associating each issue in a tree structure. The record structure generation unit 22 further records information designed during security risk analysis, such as the risk value of the threat included in the analysis result 31 and the constraints given as prerequisites, in the record structure 34. At this time, the record structure generation unit 22 displays the record structure 34 on a screen together with the recorded information, for example. The record structure generation unit 22 may reflect the information designed during security risk analysis by prompting the user to input the reason for selection into an issue corresponding to content that has already been decided not to be adopted in the product and then closing the issue. The record structure generation unit 22 may also prune nodes according to the value of the information asset. Assume that the security measure to be processed is user authentication in the first row of Fig. 4. In this case, as shown in Fig. 6, the recording structure generation unit 22 records in the recording structure 34 the conditions given during security risk analysis, that is, that multi-factor authentication is required and that account locking is not implemented.

[0029] (Step S5: Development Completion Determination Process) The design acquisition unit 23 determines whether the development of the target product has been completed. If the development of the target product has not been completed, the design acquisition unit 23 proceeds to step S6. On the other hand, if the development of the target product has been completed, the design acquisition unit 23 proceeds to step S9.

[0030] As a result, the processes of steps S6 to S8 are periodically executed until the development of the target product is completed. Then, as the target product is developed, information is recorded in the recording structure 34.

[0031] (Step S6: Output Processing) The output unit 25 generates output information 35 from the information recorded in the current recording structure 34. Then, the output unit 25 outputs the output information 35 to the display device via the display interface 15. As a result, the output information 35 is displayed on the display device. The output information 35 is information obtained by processing the information recorded in the recording structure 34. For example, the output unit 25 generates, as the output information 35, structured design information 33 of some or all of the information recorded in the recording structure 34, or design information 33 including the basis for selecting the content of a specific security measure. The output unit 25 may generate the output information 35 by adapting the information recorded in the recording structure 34 to a specified format such as a specification, a design document, or evidential material in a security standard.

[0032] (Step S7: Design acquisition process) The design acquisition unit 23 acquires design information 33 regarding security for the target product. By the process of step S5, the process of step S7 is repeatedly executed until the development of the target product is completed. Therefore, the design acquisition unit 23 successively acquires design information 33 during the development process of the target product.

[0033] The design information 33 is any information that has been considered or created in order to implement security measures. For example, the design information 33 includes security objectives, components for each objective, key points for implementing security functions, source code, test code and results, operational security measures, the rationale for the design, and descriptions of the consideration process.

[0034] The design acquisition unit 23 provides an interface for inputting design information 33 in association with the record structure 34. Specifically, the design acquisition unit 23 interacts with the output unit 25 to interactively acquire the design information 33 while displaying the current record structure 34. That is, the design acquisition unit 23 acquires the design information 33 by inputting the design information 33 in association with the output information 35 displayed by the output unit 25. The design acquisition unit 23 outputs the input design information 33 and the associated record structure 34 to the record management unit 24. Note that the design acquisition unit 23 may extract design information 33 regarding the security of the target product from deliverables generated in the development process of the target product, such as specifications, design documents, or meeting notes. For example, the design acquisition unit 23 may use the deliverables as input and extract the design information 33 by analyzing text using machine learning or the like.

[0035] (Step S8: Record Management Processing) The record management unit 24 updates the record structure 34 with the design information 33 acquired in step S7. Specifically, the record management unit 24 records the design information 33 in the node of the record structure 34 with which the design information 33 is associated. For example, as shown by the "Password Expiration Date" node in FIG. 7, the record management unit 24 describes the determined design content and its rationale or review process for each node of the record structure 34. Furthermore, as shown by the "Password Character Type" and "Error Message Notification" nodes in FIG. 8, the record management unit 24 adds nodes to the record structure 34 according to the determined design content. Furthermore, the record management unit 24 may store deliverables created in the development process of the target product in association with the record structure 34, such as the source code, test code, and test results in FIG. 8.

[0036] (Step S9: Final Output Processing) The output unit 25 generates output information 35 from the information recorded in the current recording structure 34 and the analysis result 31. Then, the output unit 25 outputs the output information 35 to the display device via the display interface 15. As a result, the output information 35 is displayed on the display device. When a user refers to the rationale for an implementation policy of a specific security measure, the output unit 25 acquires the recording structure 34 corresponding to the security measure. Then, the output unit 25 displays the design rationale associated with the node corresponding to the implementation policy. The output unit 25 may also acquire information recorded in all recording structures 34 and compare it with the security measures in the analysis result 31 by referring to the meta-information held by each node. As a result, the output unit 25 may generate evaluation values ​​such as a design completion rate, an implementation completion rate, or a test completion rate for each security measure of the product, as shown in FIG. 9 .

[0037] It is possible that no template 32 related to the name of the security measure exists in step S3. In this case, the record structure generation unit 22 prompts the user to select a blank template 32, and then prompts the user to record the design information 33 using a tree structure in the processes from step S4 onwards.

[0038] ***Effects of First Embodiment*** As described above, the design support device 10 according to the first embodiment records design information 33 every time it is acquired during the development process of the target product in a recording structure 34 that structures the content to be considered when implementing security measures. This allows information obtained during the design process of security measures to be appropriately recorded and traceable later. As a result, it becomes possible to evaluate the design process of security measures from the perspective of whether it is appropriate.

[0039] In particular, the design support device 10 according to the first embodiment records the design information 33 in a tree-structured recording structure 34, so that the design information 33 is structured and recorded, thereby making it possible to appropriately evaluate whether security measures have been implemented without any omissions.

[0040] Furthermore, the design support device 10 according to the first embodiment can record everything from security measures to deliverables such as source code in association with each other. This makes it possible to evaluate the correctness of a series of processes from design to implementation. Furthermore, it is possible to easily divert the data to similar products.

[0041] ***Application Example*** The design support device 10 according to the first embodiment can be applied to a software quality evaluation system. For example, a security analysis device is provided in addition to the design support device 10. Then, the security analysis device performs analysis using security design information recorded and structured by the design support device 10. This makes it possible to sequentially evaluate software quality from a security perspective. Conventional technology has only been able to perform a single evaluation of compliance with a specific security standard. By using the design support device 10 according to the first embodiment, evaluation from multiple perspectives, such as verification of security processes, satisfaction of security functions, and tracing of security requirements and security functions, becomes possible.

[0042] ***Other Configurations*** <Modification 1> In the first embodiment, each functional component is realized by software. However, in Modification 1, each functional component may be realized by hardware. The differences between Modification 1 and the first embodiment will be described below.

[0043] When each functional component is realized by hardware, the design support device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.

[0044] Possible electronic circuits include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, and an FPGA. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by a single electronic circuit, or each functional component may be distributed across multiple electronic circuits.

[0045] <Modification 2> As a modification 2, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0046] The processor 11, the memory 12, the storage 13, and the electronic circuitry are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0047] Furthermore, the term "unit" in the above description may be read as a "circuit," "step," "procedure," "process," or "processing circuit."

[0048] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Furthermore, one or more of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as needed.

[0049] 10 Design support device, 11 Processor, 12 Memory, 13 Storage, 14 Input interface, 15 Display interface, 16 Network interface, 21 Result acquisition unit, 22 Record structure generation unit, 23 Design acquisition unit, 24 Record management unit, 25 Output unit, 31 Analysis results, 32 Template, 33 Design information, 34 Record structure, 35 Output information, 41 Template DB.

Claims

1. A design support device comprising: a record structure generation unit that generates a record structure for recording design information about security measures for a target product, the record structure structuring content to be considered when implementing the security measures; a design acquisition unit that sequentially acquires design information about the security of the target product during the development process of the target product; and a record management unit that records the design information in the record structure generated by the record structure generation unit each time the design information is acquired by the design acquisition unit.

2. The design support device of claim 1, wherein the record structure generation unit generates the record structure by hierarchically classifying the contents to be considered in implementing the security measures according to at least one of the steps in the design and development process and the level of specificity of the contents, and organizing them in a tree structure.

3. The design support device according to claim 1 or 2, wherein the design information includes at least one of the design rationale and information presented in the design review process in addition to the design contents.

4. A design support device according to any one of claims 1 to 3, wherein the record management unit stores deliverables other than design content created in the development process of the target product in association with the record structure.

5. The design support device according to any one of claims 1 to 4, further comprising a result acquisition unit that acquires analysis results indicating security measures necessary for the target product identified by performing a security risk analysis on the target product, and the record structure generation unit generates the record structure for recording design information regarding the security measures indicated by the analysis results acquired by the result acquisition unit.

6. The design support device according to any one of claims 1 to 5, further comprising: an output unit which outputs the information recorded in the recording structure after adapting it to a specified format.

7. The design support device according to any one of claims 1 to 6, wherein the design acquisition unit extracts design information regarding security for the target product from an outcome generated in the development process of the target product.

8. A design support method in which a computer generates a record structure for recording design information about security measures for a target product, the record structure structuring the contents to be considered when implementing the security measures, the computer sequentially acquires design information about the security of the target product during the development process of the target product, and the computer records the design information in the record structure each time the design information is acquired.

9. A design support program that causes a computer to function as a design support device that performs a record structure generation process that generates a record structure for recording design information about security measures for a target product, the record structure structuring the content to be considered when implementing the security measures; a design acquisition process that sequentially acquires design information about the security of the target product during the development process of the target product; and a record management process that records the design information in the record structure generated by the record structure generation process each time the design information is acquired by the design acquisition process.

Images